Identity theft recovery is a project with a paper trail, not a single phone call. Fake cards, loans, tax filings, or medical bills in your name need documentation, freezes, disputes, and time. If the file mixes your SSN with someone else’s name, read Synthetic identity fraud alongside this sequence. Prevention habits live in How to protect your SSN and Phishing and account takeover; this page is what to do after you confirm damage.
First 48 hours (stabilize)
- Call the fraud lines for every bank, card, and lender showing unauthorized activity. Use numbers on the back of the card or the official site, not a number in a text.
- Place a credit freeze at Equifax, Experian, and TransUnion (free under federal rules). Add a fraud alert if you want lenders to take extra verification steps. Details: Credit freezes and fraud alerts.
- Change passwords on email first, then banks, then government logins. Turn on stronger MFA where available.
- File at IdentityTheft.gov (FTC) to generate a recovery plan and affidavit you can send to furnishers and collectors. Step-by-step reporting: How to report credit report fraud.
- Pull all three free credit reports at AnnualCreditReport.com and save dated PDFs (Free credit reports).
If a thief took over an existing login (not only new accounts), follow the first-hour bank steps in the phishing guide while you freeze bureaus.
Worked example: fake card and hard inquiry
Casey sees a hard inquiry from a bank Casey never applied to, then a new revolving account with a $2,400 balance. Casey:
- Freezes all three bureaus the same evening.
- Calls the issuer’s fraud line from the official site; account closed as fraud; case number saved.
- Completes IdentityTheft.gov steps and downloads the affidavit.
- Disputes the account and inquiry with each bureau that shows them, attaching the affidavit and police/FTC documentation (How to dispute an error on your credit report).
- Requests an IRS IP PIN the next tax season after checking for a fraudulent refund filing.
- Keeps the freeze on for six months while monitoring; thaws only for a planned apartment application.
Score recovery is not instant. Accurate removals and clean on-time history on legitimate accounts rebuild credit scores over months.
Parallel tracks people miss
| Track | Why it matters |
|---|---|
| IRS Form 14039 / IP PIN | Tax refund fraud and filing in your SSN |
| SSA my Social Security | Someone else should not claim your account first |
| ChexSystems / early warning | Fake checking accounts can block new bank opens |
| Medical identity theft | Wrong bills and records; request accounting from providers |
| Debt collectors on fake accounts | Send FTC affidavit; do not “settle” fraud as if it were yours (Debt collectors and your rights) |
Rebuilding habits after the cleanup
- Keep freezes on when you are not actively applying for credit. If the trigger was a corporate data breach rather than a stolen wallet, start with Account takeover after a data breach. Same-day card and freeze sequence when the wallet itself is the incident: Stolen wallet financial checklist.
- Autopay legitimate cards in full; do not open five new store cards to “boost” a score after fraud.
- Recheck reports at 30 and 90 days; re-dispute anything that returns.
- Ignore recovery scammers who demand gift cards or remote access to “clear” your record (Credit and debt scams).
- Document every case number in one folder (digital + paper).
Checklist
- Freeze Equifax, Experian, TransUnion; consider an extended fraud alert.
- Close or freeze compromised bank/card accounts; get case numbers.
- File IdentityTheft.gov plan; save the affidavit PDF.
- Pull and annotate all three credit reports; dispute fakes in writing.
- Address IRS, SSA, ChexSystems, and medical records if those doors were hit.
- Keep freezes on; thaw briefly only for planned, verified applications.
- Re-pull reports for 3–6 months; watch for returning tradelines.
Educational only. Not legal advice or identity-theft representation. Agency forms and bureau procedures change; use IdentityTheft.gov, AnnualCreditReport.com, IRS.gov, and SSA.gov for current steps.